Azure tenant

As explained in Azure Security

An Azure tenant is a dedicated Microsoft Entra identity boundary that represents an organization and contains its directory and associated subscriptions.

An Azure tenant represents an organization in Azure. It provides a dedicated directory for identity information about users, groups, and applications, and it performs identity and access management functions for tenant resources. section 2.1.1

A tenant is created when an Azure subscription is created. One Microsoft Entra ID directory can be associated with many subscriptions, while each subscription is associated with only one directory. This lets multiple subscriptions use the same secured identities. section 2.1.1

Figure 2.2 The relationship between Azure AD and Azure subscriptions

Use the relationship diagram to see how one tenant directory can serve multiple Azure subscriptions. section 2.1.1

The tenant is also a logging boundary. Azure monitoring can collect data from applications, operating systems, compute resources, subscriptions, and tenant-level services such as Microsoft Entra ID. section 9.1

Tenant-level Microsoft Entra ID logs support identity investigation:

• Audit logs record directory events involving users, groups, and applications, including password resets, group membership changes, application changes, and consent. section 9.1.1
• Sign-in logs classify interactive and noninteractive user sign-ins, service principal sign-ins, and managed identity sign-ins. section 9.1.1

Investigating a suspicious password reset

A password reset can be a legitimate self-service or administrator action, but it can also signal suspicious activity. Audit log records can identify which user’s password changed and who performed the operation; they can also expose attempts to add a compromised user to an administrator group. section 9.1.1

Table 9.1 Questions that can be answered by each log category in Microsoft Entra ID audit logs (view table figure)

Events relating to users	Events relating to groups	Events related to applications
What operations did an administrator perform in the directory? Which type of operation was performed on users? Who are these users? How many passwords have been changed?	What changes were made to group ownership? What changes were made to group membership? What groups (if any) have been added?	What applications have been added or changed? Who gave consent to an application? What changes (if any) were made to a service principal for an application?

Browse the audit-log question categories to map user, group, and application changes to an investigation. section 9.1.1

How Azure Security covers it

How deep it goes

Defines the tenant and subscription relationship, then applies it to Microsoft Entra ID audit and sign-in log collection without configuration steps.

Examples

Uses password resets, administrator-group additions, application consent, and four sign-in types as tenant-level log examples.

What it assumes

Introduces the tenant as an early Azure concept while relying on basic awareness of subscriptions and identity services.

What you can do after

Evaluate/understand which identity events and sign-ins can be investigated at the Azure tenant level.

How it connects

Connects Azure tenants with Azure AD, Microsoft Entra ID, Azure subscriptions, audit logs, sign-in logs, users, groups, and applications.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• Azure subscriptionhas part · An Azure subscription is a management and billing boundary that provides access to Azure services and organizes the resources created within it.
• identity directoryhas part · An identity directory is a store of identity-related information for users, groups, applications, and other entities.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.